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METHOD AND SYSTEM FOR MONIT ORING A COMPUTER SYSTEM 

The invention relates to a method and a system for 
5 monitoring and changing the operation of a computer system 
which comprises a plurality of computers in a local area 
network or a plurality of interconnected local area net- 
works, each having a plurality of computers. 

Equipment and programs which are intended for moni- 
10 toring the operation of a computer or the execution of a 
program are previously known. However, they are specific 
for the computer concerned or the program concerned. 

The object of the present invention is to provide a 
common instrument, i.e. a general method and a general 
15 system for such monitoring and changing of a computer 

system having a plurality of computers interconnected in 
at least one local area network. Such monitoring and 
changing may concern e.g. error processing, i.e. detect- 
ing, registering and rectifying errors occurring during 
20 the operation of a computer system; performance proces- 
sing, i.e. detecting, registering and changing the per- 
formance of a computer system in operation; and utilisa- 
tion processing, i.e. detecting, registering and changing 
the utilisation of different resources of the computer 
25 system, which are utilised by different users and 
programs . 

In a system for monitoring and changing the operation 
of a computer system of the type mentioned by way of intro- 
duction, the object of the invention is achieved by the 

30 system comprising at least one event report generator in 
each program which is executable in the computer system and 
whose execution should be monitored; an event processing 
machine for processing events which are reported by an 
event report generator in a monitored program during the 

35 execution thereof, depending on a flexible rule base which 
is included in the event processing machine and associates 
a certain event with a predetermined action, for deter- 
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mining the action associated with the reported event; 
equipment controlled by the event processing machine and 
adapted to perform an action determined by the event pro- 
cessing machine; and an interface for transferring informa- 

5 tion about an event reported by an event report generator 
in a monitored program, to an event processing machine, and 
for transmitting a message regarding an action associated 
with the event, from the event processing machine, op- 
tionally via and for processing in a further event proces- 

10 sing machine, to a program executable in said computer 
system and intended for changing or starting thereof. 

Suitably a filter is directly connected to the inter- 
face and adapted to restrict the number of the events re- 
ported which are forwarded to the event processing machine. 

15 Moreover, the event processing machine suitably com- 

prises an internal state device, said rule base being 
adapted to associate a certain event with a predetermined 
action which depends on the instantaneous state of the 
internal state device. 

20 The equipment controlled by the event processing 

machine may also comprise means for registration of a 
reported event and/or for forwarding a reported event, 
optionally via and for processing in a further event 
processing machine, to an overriding part of the computer 

25 system. 

The event processing machine can advantageously be 
adaptive by being arranged to change the internal state 
device and/or the rule base in response to reported event 
reports received by the event processing machine and/or in 

30 response to determined actions. Also the function of the 
filter may be changed in this manner. 

The above-mentioned object of the invention is also 
achieved in a method for monitoring and optionally changing 
the operation of a computer system of the type mentioned by 

35 way of introduction, by the steps of incorporating at least 
one event report generator in each program which is execut- 
able in the computer system and whose execution should be 
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monitored; determining, depending on a rule base which 
associates a certain event with a predetermined action, the 
action associated with a reported event; and performing the 
determined action at least in the form of transmitting a 
5 message to a program which is executable in the computer 
system, for changing or starting thereof. 

To avoid overload in the utilisation of the rule base, 
the above-mentioned actions may suitably be determined 
merely for some of the reported events which are identical, 

10 with the exception of the time of reporting. 

The action associated with a certain event can also be 
made dependent on parameters other than the event's own 
parameters. These other parameters may suitably be joined 
in a separate internal state device. 

15 According to the invention, the method can be made 

adaptive by changing the rule base and/or said other para- 
meters in response to reported events. 

For example, the performed actions may also comprise 
registration of a reported event, and/or forwarding of a 

20 reported event to an overriding part of the computer 
system. 

The event report generator which should be included in 
each program which is executable in the computer system and 
whose execution should be monitored, consists of program 

25 instructions included in the program in suitable positions 
which normally are determined by the programmer. The events 
which can be reported may be anything from a normal proce- 
dure that has been executed, to a serious error that has 
occurred. The reported event may for example concern the 

30 starting or stopping of something, or the occurrence of an 
error. This makes it possible to trace the program and see 
exactly what happens during the execution of the program. 

The most interesting events are of course those con- 
cerning abnormal or critical situations and errors. Examp- 

35 les of events that could be reported are thus events for 
program sequencing, events concerning the fact that a 
certain change has been made in a computer memory, or that 
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an operator or a program has requested a certain operation, 
that an error has been detected, that repeated access 
attempts have been made, and that the storage capacity of a 
disc is fully utilised. It may also be of interest to re- 
5 port events which may constitute data for statistics, e.g. 
different users' or different programs' utilisation of 
various resources in a computer system. 

The report of an event must comprise an event identi- 
fier which need to be unique in the program concerned only, 

10 since before reaching the event processing machine, the 
event report is automatically supplemented with data re- 
garding its source and the point of time of the generation, 
in addition to the identifier part, the event report may 
comprise a computer part containing data which are neces- 

15 sary for making a decision regarding a certain action, or 
for further processing of the event at issue. The computer 
part is suitably structured as one or more parameter iden- 
tifiers and the. associated parameter values. 

Such programs as should be able to receive an action 

20 determined by the event processing machine in the form of a 
message to the program should of course be provided with 
program instructions for processing messages received. A 
determined action may of course consist of a number of 
subactions comprising a number of messages to different 

25 programs in different computers in the computer system. The 
messages may concern the program execution; for example, in 
case of a high load on a resource in the computer system, 
the program may be controlled to use this resource less 
frequently, or the program may be interrupted. The receipt 

30 of a message may in turn trigger an event report, whereby 
the determining of a certain action may be carried out in 
response to different events in different programs at 
different points of time. 

The event processing machine, which normally is to be 

35 found in a server if there is one local area network, may 
be realised as software only or as a combination of soft- 
" ware and hardware. The rule base in form of software in- 
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eluded in the event processing machine comprises a set of 
rules having one condition part and one action part. The 
condition part preferably comprises a logical combination 
of a number of subconditions where the information con- 
5 tained in an event report makes it possible to determine 
whether one or more subconditions are satisfied. The in- 
formation in the event report, which is useful for this 
purpose, may consist of information in the event identifier 
as well as information in the accompanying data r i.e. 

10 different parameter values. The satisfying of certain sub- 
conditions need, however, not be dependent on the informa- 
tion in a certain event report, but may instead be depen- 
dent on internal states in the event processing machine. 
These internal states are according to the invention 

15 represented in the internal state device in which the 
internal states may concern, for example, the count in 
different types of counters, the value of a state variable, 
or the value of a data set. 

While taking into consideration that some events may 

20 occur at high rate, and that it is not always desirable 

that each occurrence of the events is received and proces- 
sed by the event processing machine which then could be 
overloaded, use is according to the invention suitably made 
of a filter positioned before the event processing machine 

25 and adapted to determine for each separate event whether 

this should be forwarded to the event processing machine or 
not. This may be done by forwarding every nth event of a 
certain type. The filter is preferably made as software. 
The equipment controlled by the event processing 

30 machine normally is a combination of software and hardware. 
The equipment may comprise e.g. memory means for regis- 
tering the information or parts of the information in an 
event report. This form of information logging is of great 
value and allows postprocessing of registered information 

35 to produce statistics of various types, for example con- 
cerning the performance of the computer system, different 
users' utilisation of the system, programs in the system or 
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resources included therein, as well as statistics regarding 
the occurrence of errors. The equipment also executes ac- 
tions determined by the event processing machine such as 
transmitting a message to a program which is executable in 
5 the computer system, and starting such a program. Moreover, 
by means of an action determined by the event processing 
machine, the equipment can update the state device change 
the rule base and also change the function of the filter. 
The equipment controlled by the event processing machine 
10 can also initiate an alarm and forward information, which 
is essential for the operation of the entire computer 
system to an overriding part of the computer system. 

An embodiment of the invention will now be described 
in more detail below with reference to the accompanying 
15 drawings. Fig. 1 is a schematic view of a conventional com- 
puter system. Fig. 2 is a schematic view illustrating the 
function of a system according to the present invention 
Fig 3 illustrates in a simplified manner the contents of 
an object processed by the system according to the inven- 
20 tion. Fig. 4 is a schematic view of the configuration of a 
system according to the invention. 

The system according to the invention is preferably 
used in computer systems which may comprise a number of 
local area networks LAN1— LANn, as shown in Fig. 1, each 
25 local area network comprising a plurality of computers, a 
server and further equipment, e.g. printers, and the local 
area networks are being connected with each other and wxth 
an overriding part, in the form of e.g. a central server 
which preferably is physically included in one or some of 

30 the local area networks. 

As shown in Fig. 2, the event processing according to 
the invention consists of three phases, viz. a configura- 
tion phase 1, a running time processing phase 2, and a 
postprocessing phase 3. 

35 The configuration phase 1 comprises registration of 

processed objects, i.e. programs or certain equipment for 
the running of programs, events, to be registered, and, for 
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these events, identifiers and attributes including para- 
meters, as well as configuration of filters, rules and 
actions . 

The running time processing phase 2 includes the 
5 actual processing of reported events on the basis of the 
previously executed configuration. 

The third phase 3 implies postprocessing of the data 
which according to one type of action have been stored in a 
log file. Such postprocessing may for example concern the 
10 producing of statistics based on the information logged. 

As indicated in Fig. 2, a program developer or admin- 
istrator is required for the first phase 1, i.e. the con- 
figuration phase. 

During the running time processing, an event is re- 
15 ported from a processed object 4 and triggers different 

types of actions, e.g. starting a program 5, transmitting a 
message to a processed object 6, transmitting a message to 
a user 7, or logging information in a log file 8 for sub- 
sequent postprocessing which can be performed by an ad- 
20 ministrator. 

To be processable by means of the system according to 
the invention for monitoring and, optionally, changing the 
operation of a computer system, a processed object 4, i.e. 
normally a program executable in the system, should include 
25 at least one event report generator 9 which reports the 
occurrence of an event to the event processing system ac- 
cording to the invention (see Fig. 3). Some of the proces- 
sed objects 4 should also have message receivers 10, i.e. 
predetermined instructions in an executable program, for 
30 receiving messages from the event processing system accord- 
ing to the invention. 

The embodiment of the system according to the inven- 
tion as illustrated in Fig. 4 concerns a local area network 
for which one server and only one computer are shown. The 
35 system comprises a server part 11 and a computer part 12. A 
program executable in the computer part 12, which consti- 
tutes a processed object 4, is adapted to report, by means 
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of its event report generator 9, an event via an interface 
13 to a filter 14. The filter 14 is arranged to restrict 
the number of the reported events which are forwarded to an 
event processing machine 15 positioned in the server part 
11. The event processing machine 15 comprises a rule base 
16 and an internal state device 17. The event processing 
machine 15 processes reported events on the basis of the 
information included in the event report, the rule base 16 
and, optionally, the instantaneous state of the state 
device 17 for determining different types of actions. These 
may comprise logging information in a log file 18, updating 
the event processing machine 15, i.e. its rule base 16 
and/or its state device 17, changing the filter 14, trans- 
mitting a message to a processed object 4 or a user 19, or 
15 starting a program 20. 

A processed object, such as the object 4, utilises the 
interface 13 for reporting events to the event processing 
machine 15 via the filter 14. Via the interface 13, the 
processed object 14 also receives messages from the event 
20 processing machine 15. When an event is reported via the 
interface 13 to the filter 14, it may either be disre- 
garded, i.e. rejected, or forwarded to the event processing 
machine 15. This is determined by the filter 14 which is 
positioned immediately after the interface 13. Each event 
25 has its own appearance of the filter which is relatively 
simple and may be set to disregard a reported event, to 
forward all events of a certain type to the event proces- 
sing machine, or to forward every nth event of a certain 
type to the event processing machine 15. 
30 By this construction of the filter 14, the load of the 

event processing machine 15 will be reduced as will also 
the load of the network, such that the software itself, 
i.e. the processed object 4, will not be executed slowly 
owing to its transmitting event reports. 
35 The event processing machine 15 is run in the server 

11. Each event reported to the event processing machine 
from a processed object, i.e. such events as have been 
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allowed to pass through the filter 14, is processed by the 
event processing machine 15 in conformity with the configu- 
ration thereof. This means that rules in a rule base will 
be applied to the event. Depending on the rules, the event 
5 can be logged, i.e. information in the event report may be 
registered, rejected, or some other predetermined action 
can be performed. 

The rules in the event processing machine 15 which are 
collected in the rule base 16 have the following form: 

10 if < condition > then < action > 

The condition part may contain tests on the reporting com- 
puter, reporting programs, an event, the value of a certain 
counter, a state, the value of a variable etc. The condi- 
tion part thus normally constitutes a logical combination 

15 of a number of subconditions, the satisfying of the indi- 
vidual subconditions being dependent on information in the 
event report and/or in the state device 17. 

What is going to occur is described in the action part 
of the rule, if the condition is satisfied. For example, 

20 the action part may imply one or some of the following 

requests: logging the event and these parameters to a log 
file, transmitting a message (e.g. an alarm) to a user, 
sending a message to a program (processed object), starting 
a program, updating an internal counter, state variable or 

25 variable, changing a filter value for a certain event for a 
processed object, forwarding the event report to a higher 
level in the computer system. 

It will be appreciated that in configurating the 
actual rule base, this will consist of a set of rules, the 

30 number of which will be very large. Since, for each event 
report received, the event processing machine 15 is essen- 
tially forced to go through every rule in the rule base 16 
to determine whether a rule therein has been satisfied or 
not, and thus determine whether a certain action should be 

35 taken, obviously some sort of optimisation of the rule base 
is desirable. Such an optimisation may be achieved e.g. by 
analysing the rules of the rule base for determining such 
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conditions, e.g. mutual subconditions in different rules, 
which allow the rules to be simplified and the number 
thereof to be reduced. A speeding-up of the event proces- 
sing machine 15 operating with the rule base 16 can also be 
achieved by dividing the rules into a number of levels, 
i.e. only such events as satisfy a condition on a lower 
level will be tried against conditions on higher levels. 

As is evident from what has been said above, the 
method and the system according to the invention for moni- 
toring and, optionally, changing the operation of a com- 
puter system is an extremely powerful instrument. However, 
the invention is not limited to the embodiments described 
above, but a person skilled in the art will be able to 
modify the invention within the scope of the appended 
15 claims. For example, the event processing machine may be 

distributed such that it, or parts thereof, may be run in a 
server in an optional local area network, or even one or 
more of the computers included in the system. 
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CLAIMS 

1. System for monitoring and changing the operation of 
5 a computer system which comprises a plurality of computers 
in a local area network or a plurality of interconnected 
local area networks, each having a plurality of computers, 
characterised by 

at least one event report generator (9) in each prog- 
10 ram (4) which is executable in the computer system and 
whose execution should be monitored; 

an event processing machine (15) for processing events 
which are reported by an event report generator in a moni- 
tored program during the execution thereof, depending on a 
15 rule base (16) which is included in the event processing 

machine and associates a certain event with a predetermined 
action, for determining the action associated with the 

reported event; 

equipment (18) controlled by the event processing 

20 machine and adapted to perform an action determined by the 
event processing machine; and 

an interface (13) for transferring information about 
an event reported by an event report generator in a moni- 
tored program, to an event processing machine, and for 

25 transmitting a message regarding an action associated with 
the event, from the event processing machine, optionally 
via and for processing in a further event processing 
machine, to a program executable in said computer system, 
for changing or starting thereof. 

30 2. System as claimed in claim 1, character- 

ised by a filter (14) directly connected to said inter- 
face (13) and adapted to restrict the number of the events 
reported which are forwarded to the event processing ma- 
chine (15). 

35 3. System as claimed in claim 1 or 2, charac- 

terised in that said event processing machine (15) 
comprises an internal state device (17), and that said rule 
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base (16) is adapted to associate a certain event with a 
predetermined action which depends on the instantaneous 
state of the internal state device. 

4. System as claimed in any one of claims 1-3, 
characterised in that the equipment controlled 
by said event processing machine (15) also comprises means 
for registration (18) of a reported event and/or for for- 
warding a reported event to an overriding part of the 

computer system. 

5. System as claimed in any one of claims 1-4, 
characterised in that said event processing 
machine (15) is adapted to change the internal state device 
(17) and/or the rule base (16) and/or the filter (14) xn 
response to reported events received by said event proces- 

15 sing machine and/or in response to determined actions. 

6. Method for monitoring and changing the operation of 
a computer system which comprises a plurality of computers 
in a local area network or a plurality of interconnected 
local area networks, each having a plurality of computers, 
characterised by the steps of 

incorporating at least one event report generator in 
each program which is executable in the computer system and 
whose execution should be monitored; 

determining, depending on a rule base which associates 
a certain event with a predetermined action, the action 
associated with a reported event; and 

performing the determined action at least in the form 
of transmitting a message to a program which is executable 
in the computer system, for changing or starting thereof. 

7. Method as claimed in claim 6, character- 
ised in that said action is determined merely for some 
of the reported events which are identical, with the excep- 
tion of the time of reporting. 

8. Method as claimed in claim 6 or 7, charac- 
35 terised in that the action associated with a certain 

event is also made dependent on parameters other than the 
event's own parameters. 
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9. Method as claimed in any one of claims 6-8, 
characterised in that the actions performed 
also comprise registration of a reported event and/or for- 
warding of a reported event to an overriding part of the 
5 computer system. 

10. Method as claimed in claim 8 or 9, charac- 
terised in that the rule base and/or said other 
parameters are caused to change in response to reported 
events . 
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